Summary
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* angle: insufficient input validation can cause undefined behavior (CVE-2025-6558)
* webkitgtk: A download?s origin may be incorrectly associated (CVE-2025-43240)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-31273)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-31278)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2025-43211)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43212)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43216)
* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2025-43227)
* webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-43265)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | webkit2gtk3 | 2.48.5-1.el9_6 |
| AlmaLinux · 9 | webkit2gtk3-devel | 2.48.5-1.el9_6 |
| AlmaLinux · 9 | webkit2gtk3-jsc | 2.48.5-1.el9_6 |
| AlmaLinux · 9 | webkit2gtk3-jsc-devel | 2.48.5-1.el9_6 |
Vulnerabilities 9
-
High 8.8
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote a…
KEV Jul 22, 2025 -
High 8.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, ma…
-
High 8.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iP…
-
High 7.5
This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, ma…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.6, iOS 18.6 and …
-
Medium 6.2
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iP…
-
Medium 6.2
A logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. A download's …
-
Medium 4.0
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Safari 18.6, iOS 18.6 and iP…
References
-
report
https://access.redhat.com/security/cve/CVE-2025-31273
-
report
https://access.redhat.com/security/cve/CVE-2025-31278
-
report
https://access.redhat.com/security/cve/CVE-2025-43211
-
report
https://access.redhat.com/security/cve/CVE-2025-43212
-
report
https://access.redhat.com/security/cve/CVE-2025-43216
-
report
https://access.redhat.com/security/cve/CVE-2025-43227
-
report
https://access.redhat.com/security/cve/CVE-2025-43240
-
report
https://access.redhat.com/security/cve/CVE-2025-43265
-
report
https://access.redhat.com/security/cve/CVE-2025-6558
-
report
https://bugzilla.redhat.com/2380254
-
report
https://bugzilla.redhat.com/2384385
-
report
https://bugzilla.redhat.com/2386268
-
report
https://bugzilla.redhat.com/2386269
-
report
https://bugzilla.redhat.com/2386270
-
report
https://bugzilla.redhat.com/2386271
-
report
https://bugzilla.redhat.com/2386273
-
report
https://bugzilla.redhat.com/2386274
-
report
https://bugzilla.redhat.com/2386276
-
advisory
https://errata.almalinux.org/9/ALSA-2025-13782.html